// hook-example.js
Java.perform(function() {
  // 拦截Objective-C方法
  var LoginManager = ObjC.classes.LoginManager;
  
  Interceptor.attach(LoginManager["- validateCredentials:password:"].implementation, {
      onEnter: function(args) {
          // 'this' 是目标对象
          // args[0] 是 'self'
          // args[1] 是 selector
          // args[2]开始是实际参数
          var username = ObjC.Object(args[2]).toString();
          var password = ObjC.Object(args[3]).toString();
          
          console.log("[+] validateCredentials:password: called");
          console.log("    Username: " + username);
          console.log("    Password: " + password);
          
          // 保存参数供onLeave使用
          this.username = username;
      },
      onLeave: function(retval) {
          // retval是返回值
          console.log("[+] validateCredentials:password: returned: " + retval);
          
          // 修改返回值（强制返回true）
          retval.replace(0x1);
          
          console.log("[+] Return value replaced to true");
      }
  });
});
